Risk Indicators and Risk Thresholds

In federal grants compliance, risk indicators and risk thresholds are the two working concepts behind risk-based monitoring: the practice of varying oversight intensity across a portfolio of awards based on assessed risk, rather than applying the same fixed monitoring schedule to every award regardless of actual exposure. The vocabulary is grounded directly in the Office of Management and Budget’s Uniform Guidance, 2 CFR Part 200: 2 CFR 200.206 (“Federal awarding agency review of risk posed by applicants”) requires agencies to evaluate applicant risk before making an award, and 2 CFR 200.208 (“Specific conditions”) governs what an agency can do about elevated risk once identified — up to and including a formal high-risk designation.

Risk indicators: what counts as one

A risk indicator is a specific, checkable fact about an applicant, recipient, or subrecipient — not a vague impression of trustworthiness. 2 CFR 200.206 names the factors a federal awarding agency must consider when assessing risk before an award, and the same categories are what institutions and pass-through entities generally adapt for their own subrecipient risk screens under subrecipient monitoring obligations (2 CFR 200.332):

• Financial stability — the entity’s record of effectively managing financial risk, assets, and resources.
• Quality of management systems — ability to meet the internal-control and financial-management standards 2 CFR Part 200 prescribes.
• Prior federal-award performance history — including a track record of compliance with reporting requirements on previous or current awards.
• Audit findings — results of a Single Audit or other available audit, most concretely OIG or single-audit exceptions and questioned costs.
• Ability to implement statutory, regulatory, or award-specific requirements.
• Applicant status in OMB-designated government-wide repositories (e.g., SAM.gov exclusion or integrity records).

In practice, research administrators and grants officers commonly track a wider working set of indicators that map onto those categories, including: an unresolved or repeated single-audit finding; general financial instability or going-concern language in audited financial statements; new or first-time awardee status with no history of managing federal funds at the relevant scale; an irregular, expired, or unnegotiated F&A (indirect cost) rate; and a documented history of late or noncompliant reporting. No single indicator is disqualifying by itself — each is one input into an overall risk assessment.

Risk thresholds: where the line sits

A risk threshold is the predetermined materiality point at which an accumulation, severity, or specific combination of risk indicators triggers a defined escalation in oversight. Thresholds are what turn a risk assessment from a descriptive exercise into an operational one: they tell a program officer or sponsored-programs office exactly when routine monitoring is no longer sufficient and a heavier response is required. 2 CFR 200.208 lists the escalation options available once a threshold is crossed, which an agency selects and tailors to the specific risk identified:

• Converting payments from advance to reimbursement-only.
• Withholding authority to proceed to a subsequent budget or project period until performance is demonstrated.
• Requiring additional, more detailed, or more frequent financial or programmatic reports.
• Requiring additional project monitoring.
• Requiring the recipient to obtain technical or management assistance.
• Establishing additional prior-approval requirements.

At the far end of that escalation sits formal high-risk designation, the most severe threshold outcome under 2 CFR 200.208. Before imposing any specific condition — not only a high-risk designation — the regulation requires the awarding agency to notify the recipient in writing of the nature of the condition, the reason it is being imposed, what corrective action would resolve it, the timeline for that action, and the method for requesting reconsideration, and to remove the condition promptly once the underlying risk is resolved. A threshold decision is meant to be a documented, reasoned response to specific, cited evidence, not a discretionary label.

How the two concepts fit together in portfolio oversight

Risk indicators and risk thresholds work as a pair across two layers of the grants system:

• Pre-award (agency to applicant): under 2 CFR 200.206, the awarding agency screens applicants against the indicators above before making an award decision, and may build specific conditions into the award terms from day one if a threshold is crossed at that stage.
• Post-award and pass-through (institution to subrecipient): under 2 CFR 200.332’s subrecipient-monitoring requirement, a pass-through entity (a university managing subawards, for example) runs its own comparable risk assessment of each subrecipient and calibrates monitoring intensity — desk review frequency, site-visit cadence, documentation depth — accordingly. An institution’s internal internal controls framework typically defines its own threshold rules for this layer, since 2 CFR Part 200 sets the requirement to assess and respond to risk but does not prescribe a single numeric threshold formula.

This is the same underlying logic that risk-based monitoring (RBM) applies in the clinical-trials context under ICH E6 — concentrate oversight resources where risk indicators show they are actually needed — adapted here to federal financial and programmatic grants compliance rather than trial data integrity.

Related CASRAI resources

For the broader compliance framework these terms sit inside, see the Federal Grant Compliance Checklist and Institutional Internal Controls for Federal Grant Compliance. For the audit findings that most commonly function as risk indicators, see OIG reports and the OMB Compliance Supplement. For the pass-through obligation that applies these concepts to subawards, see subrecipient monitoring.